At the edge of tweaking

Menu

Find If Your PC is Affected by Meltdown and Spectre CPU Vulnerabilities

It is no secret any more that all Intel CPUs released during the past decade are affected by a serious issue. A specially malformed code can be used to steal the private data of any other process, including sensitive data like passwords, security keys and so on. In this article, we will see how to find if your PC is affected by the issue.

In short, both Meltdown and Spectre vulnerabilities allow a process to read the private data of any other process, even from outside a virtual machine. This is possible due to Intel's implementation of how their CPUs prefetch data. This cannot be fixed by patching the OS only. The fix involves updating the OS kernel, as well as a CPU microcode update and possibly even a UEFI/BIOS/firmware update for some devices, to fully mitigate the exploits.

Recent research indicates that ARM64 and AMD CPUs are affected as well by the Spectre vulnerability, related to speculative execution.

Available fixes

Microsoft has already released a set of fixes for all supported operating systems. Mozilla today issued an updated version of Firefox 57, and Google will protect Chrome users with version 64.

For the current version Google Chrome, you can enable extra protection by enabling Full Site Isolation. Site Isolation offers a second line of defense to make such vulnerabilities less likely to succeed. It ensures that pages from different websites are always put into different processes, each running in a sandbox that limits what the process is allowed to do. It also blocks the process from receiving certain types of sensitive documents from other sites.

Google will update Chrome again (Version 64) by the end of the month to protect against exploitation of vulnerabilities related to Meltdown and Spectre. Version 64 of Chrome has already arrived on the beta channel.

About Sergey Tkachenko

Sergey Tkachenko is a software developer from Russia who started Winaero back in 2011. On this blog, Sergey is writing about everything connected to Microsoft, Windows and popular software. Follow him on Facebook, Twitter or Google+.